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EXECUTIVE OVERVIEW 

During June and July of 2013, news of a whistleblower, US government contractor Edward Snowden, dominated 
global headlines. Snowden provided evidence of US government access to information from 
telecommunications and Internet providers via secret court orders as specified by the Patriot Act. The 
subsequent news leaks indicated that allied governments of the US may have also received some of this 
information and acted upon it in unknown ways. As this news became widespread, it led to a great deal of 
debate and soul searching about appropriate access to an individual's digital information, both within the United 
States of America and any other country. 

CSA initiated this survey to collect a broad spectrum of member opinions about this news, and to understand 
how this impacts attitudes about using public cloud providers as well as any other broadly available Internet 
service. This survey was conducted online via SurveyMonkey from June 25, 2013 to July 9, 2013. 

CSA has no way of ascertaining the effectiveness of anti-terrorist activities undertaken by governments around 
the world as a result of access to the information in the programs described by Mr Snowden. CSA leaves the 
very important task of measuring the effective of these intelligence programs to other parties. 

CSA is not representing these survey results to be indicative of anything more than what CSA members feel 
about this issue. CSA members, by their very nature, have a heightened sense of concern about issues of 
trustworthiness in cloud computing. Even so, the results point to a great deal of concern as to the impact on 
commercial cloud computing activities as a consequence of this news. CSA calls upon the key stakeholders of 
this issue to have a public dialogue to discuss issues of citizen privacy and transparency in addition to the very 
important topic of maintaining a nation's security. 

We appreciate your feedback to this survey's findings. Please provide your feedback to this survey via our public 
Linkedln forum at http://www.linkedin.com/groups?gid=1864210 . We also encourage you to become informed 
about legal and privacy issues related to cloud computing, which has rapidly become a critical infrastructure 
component of the global economy. 
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Survey Respondents 



CSA received a total of 456 responses during the survey's open period. 234 respondents identified themselves 
as responding from the USA, with 222 being rest of world. 138 respondents listed a country in Europe as their 
location. 36 respondents were from Asia Pacific. 20 respondents were from the Middle East and Africa, 19 
respondents were from Canada and 9 respondents were from Latin America. 



Survey Questions and Answers 



Survey Question 1: (For non-US residents only) Does 
the Snowden Incident make your company more or 
less likely to use US-based cloud providers? 

CSA received 207 responses from self-identified non-US 
residents. 



(For non-US residents only) Does the Snowden Incident make your 
company more or less likely to use US-based cloud providers? 



56% less likely to use US-based cloud providers 
31% no impact on usage of US-based cloud 
providers 

10% cancelled a project to use US-based cloud 
providers 

3% more likely to use US-based cloud providers 
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Survey Question 2: (For all respondents) How 
would you rate your country's processes to 
obtain user information for the purpose of 
criminal and terrorist investigations? 

CSA received 440 responses. 

• 47% Poor, there is no transparency in the 
process and I have no idea how often the 
government accesses my information 

• 32% Fair, there is some public 
information about the process and some 
instances of its usage, but it is not clear 
how prevalent these activities are. 

• 11% Unknown, I do not have enough 



(For all respondents) How would you rate your country's processes 
for obtain user information for the purpose of criminal and terrorist 
investigations? 




Excellent, the process is 
I well documented and I 
have a good understan... 

Fair, there is some pu bl ic 
I information about the 
process and some ins... 
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Unknown, I do not have 
eroL;h information to 
make an informed judgment 
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information to make an informed judgment 

• 10% Excellent, the process is well documented and I have a good understanding of the prevalence of the 
access to user information by law enforcement or national security organizations. 

Survey Question 3: (For US residents only) Does the Snowden Incident make it more difficult for your 
company to conduct business outside of the US? 

CSA received 220 responses from self-identified US residents. 

• 36% Yes 

• 64% No 

Survey Question 4: (For all respondents) If you have concerns about this recent news, which of the following 
actions do you think would be the best course to mitigate concerns? 

CSA received 423 responses. 

• 41% The Patriot Act should be repealed in its 
entirety. 

• 45% The Patriot Act should be modified to 
tighten the oversight of permitted activities 
and to provide greater transparency as to how 
often it is enacted. 

• 13% The Patriot Act is fine as is. Identifying 
terrorists is a very difficult job and we simply 
need to provide more education about the 
Patriot Act and its counterparts within other 
countries. 



Survey Question 5: (For all respondents) Should companies who have been subpoenaed through provisions of 
the Patriot Act, such as FISA (Foreign Intelligence Surveillance Act) be able to publish summary information 
about the amount of responses they have made? 

CSA received 438 responses. 

• 91% Yes 

• 9% No 



(For all respondents) If you have concerns about this recent news, 
which of the following actions do you think would be the best course to 
mitigate concerns? 




The Patriot Act 
I ■ should be repealed 

The Patriot Act should be 
MB modified to tighten the 
oversight of pern-it... 

Tbe Patriot Act is fine 
■■I as is. Identifying 

terrorists is s very ciff... 
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Follow up and further reading 



The numerous open-ended comments provided by survey respondents indicate that this is a highly charged 
issue, which will likely evolve as more information is gained about the facts of government programs. CSA 
continues to study the respondent comments and will publish insights gained from these comments. CSA will 
certainly be obligated to provide additional forums for member feedback regarding this issue. Greater 
discussion of the balance between safety, privacy, government transparency and commercial interests must be 
obtained. 

We encourage parties interested in this topic to continue to follow CSA. Please provide your feedback to this 
survey via our public Linkedln forum at http://www.linkedin.com/groups?gid=1864210 . We also encourage you 
to get involved and read the research contained in two CSA initiatives: 

CSA Legal Information Center: https://cloudsecurityalliance.org/research/clic/ 

Privacy Level Agreement: https://cloudsecurityalliance.Org/research/pla/# overview 
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